CVE-2019-19945

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-03-16 · updated 2026-06-17
Weakness: CWE-125

Description

uhttpd in OpenWrt through 18.06.5 and 19.x through 19.07.0-rc2 has an integer signedness error. This leads to out-of-bounds access to a heap buffer and a subsequent crash. It can be triggered with an HTTP POST request to a CGI script, specifying both "Transfer-Encoding: chunked" and a large negative Content-Length value.

Affected products

openwrt: from 18.06.0 through 18.06.5; 19.07.0, 19.07.0-rc1, 19.07.0-rc2

References

https://github.com/openwrt/openwrt/commits/master
https://openwrt.org/advisory/2020-01-13-1
https://github.com/openwrt/openwrt/commits/master
https://openwrt.org/advisory/2020-01-13-1

Get alerted when CVE-2019-19945 or the next vulnerability affects your stack